From 46df417544f4f7fa3438caada0dc0e534a694343 Mon Sep 17 00:00:00 2001 From: Florian Westphal Date: Fri, 14 Apr 2023 15:01:34 +0200 Subject: netfilter: nf_tables: do not store rule in traceinfo structure pass it as argument instead. This reduces size of traceinfo to 16 bytes. Total stack usage: nf_tables_core.c:252 nft_do_chain 304 static While its possible to also pass basechain as argument, doing so increases nft_do_chaininfo function size. Unlike pktinfo/verdict/rule the basechain info isn't used in the expression evaluation path. gcc places it on the stack, which results in extra push/pop when it gets passed to the trace helpers as argument rather than as part of the traceinfo structure. Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso --- net/netfilter/nf_tables_core.c | 15 +++++++-------- net/netfilter/nf_tables_trace.c | 14 ++++++++------ 2 files changed, 15 insertions(+), 14 deletions(-) (limited to 'net') diff --git a/net/netfilter/nf_tables_core.c b/net/netfilter/nf_tables_core.c index 6debe8b2623f..4d0ce12221f6 100644 --- a/net/netfilter/nf_tables_core.c +++ b/net/netfilter/nf_tables_core.c @@ -43,6 +43,7 @@ static inline void nf_skip_indirect_calls_enable(void) { } static noinline void __nft_trace_packet(const struct nft_pktinfo *pkt, const struct nft_verdict *verdict, + const struct nft_rule_dp *rule, struct nft_traceinfo *info, enum nft_trace_types type) { @@ -51,7 +52,7 @@ static noinline void __nft_trace_packet(const struct nft_pktinfo *pkt, info->type = type; - nft_trace_notify(pkt, verdict, info); + nft_trace_notify(pkt, verdict, rule, info); } static inline void nft_trace_packet(const struct nft_pktinfo *pkt, @@ -62,8 +63,7 @@ static inline void nft_trace_packet(const struct nft_pktinfo *pkt, { if (static_branch_unlikely(&nft_trace_enabled)) { info->nf_trace = pkt->skb->nf_trace; - info->rule = rule; - __nft_trace_packet(pkt, verdict, info, type); + __nft_trace_packet(pkt, verdict, rule, info, type); } } @@ -110,6 +110,7 @@ static void nft_cmp16_fast_eval(const struct nft_expr *expr, static noinline void __nft_trace_verdict(const struct nft_pktinfo *pkt, struct nft_traceinfo *info, + const struct nft_rule_dp *rule, const struct nft_regs *regs) { enum nft_trace_types type; @@ -131,7 +132,7 @@ static noinline void __nft_trace_verdict(const struct nft_pktinfo *pkt, break; } - __nft_trace_packet(pkt, ®s->verdict, info, type); + __nft_trace_packet(pkt, ®s->verdict, rule, info, type); } static inline void nft_trace_verdict(const struct nft_pktinfo *pkt, @@ -139,10 +140,8 @@ static inline void nft_trace_verdict(const struct nft_pktinfo *pkt, const struct nft_rule_dp *rule, const struct nft_regs *regs) { - if (static_branch_unlikely(&nft_trace_enabled)) { - info->rule = rule; - __nft_trace_verdict(pkt, info, regs); - } + if (static_branch_unlikely(&nft_trace_enabled)) + __nft_trace_verdict(pkt, info, rule, regs); } static bool nft_payload_fast_eval(const struct nft_expr *expr, diff --git a/net/netfilter/nf_tables_trace.c b/net/netfilter/nf_tables_trace.c index e635104a42be..6d41c0bd3d78 100644 --- a/net/netfilter/nf_tables_trace.c +++ b/net/netfilter/nf_tables_trace.c @@ -125,9 +125,10 @@ static int nf_trace_fill_pkt_info(struct sk_buff *nlskb, static int nf_trace_fill_rule_info(struct sk_buff *nlskb, const struct nft_verdict *verdict, + const struct nft_rule_dp *rule, const struct nft_traceinfo *info) { - if (!info->rule || info->rule->is_last) + if (!rule || rule->is_last) return 0; /* a continue verdict with ->type == RETURN means that this is @@ -140,7 +141,7 @@ static int nf_trace_fill_rule_info(struct sk_buff *nlskb, return 0; return nla_put_be64(nlskb, NFTA_TRACE_RULE_HANDLE, - cpu_to_be64(info->rule->handle), + cpu_to_be64(rule->handle), NFTA_TRACE_PAD); } @@ -166,9 +167,9 @@ static bool nft_trace_have_verdict_chain(const struct nft_verdict *verdict, return true; } -static const struct nft_chain *nft_trace_get_chain(const struct nft_traceinfo *info) +static const struct nft_chain *nft_trace_get_chain(const struct nft_rule_dp *rule, + const struct nft_traceinfo *info) { - const struct nft_rule_dp *rule = info->rule; const struct nft_rule_dp_last *last; if (!rule) @@ -187,6 +188,7 @@ static const struct nft_chain *nft_trace_get_chain(const struct nft_traceinfo *i void nft_trace_notify(const struct nft_pktinfo *pkt, const struct nft_verdict *verdict, + const struct nft_rule_dp *rule, struct nft_traceinfo *info) { const struct nft_chain *chain; @@ -199,7 +201,7 @@ void nft_trace_notify(const struct nft_pktinfo *pkt, if (!nfnetlink_has_listeners(nft_net(pkt), NFNLGRP_NFTRACE)) return; - chain = nft_trace_get_chain(info); + chain = nft_trace_get_chain(rule, info); size = nlmsg_total_size(sizeof(struct nfgenmsg)) + nla_total_size(strlen(chain->table->name)) + @@ -248,7 +250,7 @@ void nft_trace_notify(const struct nft_pktinfo *pkt, if (nla_put_string(skb, NFTA_TRACE_TABLE, chain->table->name)) goto nla_put_failure; - if (nf_trace_fill_rule_info(skb, verdict, info)) + if (nf_trace_fill_rule_info(skb, verdict, rule, info)) goto nla_put_failure; switch (info->type) { -- cgit v1.2.3